@openwop/openwop-conformance 1.106.1 → 1.124.0

package/dist/lib/profiles.js

@@ -19,7 +19,24 @@
  * Closed v1.x catalog. Adding a profile requires an RFC per
  * `RFCS/0001-rfc-process.md`.
  */
+/**
+ * RFC 0155 §A/§E — deprecated profile aliases, keyed by alias → canonical id.
+ * A certification bundle v2 (`certification-bundle-v2.schema.json`) MUST name
+ * canonical ids in `claimedProfiles`; an alias that also derives goes in
+ * `aliases`, never in `claimedProfiles` — a badge cannot be substantiated by a
+ * name that no longer means what it did.
+ */
+export const DEPRECATED_PROFILE_ALIASES = {
+    'openwop-core': 'openwop-discovery-core',
+};
 export const PROFILE_NAMES = [
+    // RFC 0155 §A (2026-08-16): `openwop-discovery-core` is the CANONICAL name of
+    // the discovery predicate; `openwop-core` is its DEPRECATED ALIAS for all of
+    // v1 and derives exactly when the canonical name derives — both or neither.
+    // The predicate is a discovery-payload check and says nothing about whether a
+    // run can be started, suspended, or replayed; the executable floor is
+    // `openwop-core-standard` (`core-standard-profile.md`, RFC 0088).
+    'openwop-discovery-core',
     'openwop-core',
     'openwop-interrupts',
     'openwop-stream-sse',
@@ -383,8 +400,10 @@ export function isCoreStandard(c) {
  */
 export function deriveProfiles(c) {
     const result = [];
-    if (isCore(c))
-        result.push('openwop-core');
+    if (isCore(c)) {
+        result.push('openwop-discovery-core');
+        result.push('openwop-core'); // deprecated alias — never alone (RFC 0155 §A)
+    }
     if (isInterrupts(c))
         result.push('openwop-interrupts');
     if (isStreamSse(c))
@@ -412,7 +431,8 @@ export function deriveProfiles(c) {
  */
 export function hasProfile(c, profile) {
     switch (profile) {
-        case 'openwop-core':
+        case 'openwop-discovery-core':
+        case 'openwop-core': // deprecated alias of `openwop-discovery-core` (RFC 0155 §A)
             return isCore(c);
         case 'openwop-interrupts':
             return isInterrupts(c);
@@ -447,7 +467,19 @@ export const PROFILE_FLOOR_SCENARIOS = {
             'idempotency.test.ts',
             'idempotency-key-determinism.test.ts',
             'webhook-negative.test.ts',
-            'audit-log-verification.test.ts',
+            // Removed 2026-08-16 (S6): since RFC 0088/0089 this list carried
+            // `audit-log-verification.test.ts` — a file that has NEVER existed. The
+            // RFC 0148 §A ledger surfaced it on its first end-to-end `--certify` run
+            // as an unclassified floor requirement. The scenario it meant is
+            // `audit-log-integrity.test.ts`, which soft-skips unless the host
+            // advertises the OPTIONAL annex profile `openwop-audit-log-integrity`
+            // (auth-profiles.md §"Audit-log integrity" — `GET /v1/audit/verify` is
+            // REQUIRED-when-profile-claimed, not a core MUST). §C's membership rule
+            // is "no soft-skip, no seam, no env-gate", and §B's predicate does not
+            // include that profile, so by RFC 0088's own rule the row was never a
+            // floor scenario. Audit-log integrity remains required by
+            // `openwop-production` (PROFILE-DECISION-GUIDE) and certifiable on its
+            // own profile; it is not part of `openwop-core-standard`.
         ],
         requiredAnyPrefix: ['interrupt-'],
     },
@@ -460,7 +492,8 @@ export const PROFILE_FLOOR_SCENARIOS = {
     // against nothing (RFC 0148 §C, gap G6).
     // `profiles.md` §`openwop-core` is a pure discovery-payload predicate — it
     // names no runtime scenario, so the predicate IS the whole claim.
-    'openwop-core': { required: [], discoveryOnly: true },
+    'openwop-discovery-core': { required: [], discoveryOnly: true },
+    'openwop-core': { required: [], discoveryOnly: true }, // deprecated alias (RFC 0155 §A)
     // `profiles.md` §`openwop-fixtures`: "The profile is discovery-payload-only —
     // it confirms the host claims SOME fixture, not that any specific fixture is
     // wired."
@@ -475,18 +508,55 @@ export const PROFILE_FLOOR_SCENARIOS = {
     'openwop-stream-poll': { required: ['stream-modes.test.ts'] },
     // `profiles.md` §`openwop-node-packs`: "a host passes `openwop-node-packs`
     // when it passes those scenarios."
-    'openwop-node-packs': { required: ['pack-registry.test.ts', 'pack-registry-publish.test.ts'] },
-    // ── Deliberately NOT transcribed ───────────────────────────────────────────
-    // `openwop-replay-fork` cannot be expressed by this model. `profiles.md`
-    // §`openwop-replay-fork` says "Hosts MAY support either or both modes; the
-    // conformance scenarios pass on whichever mode the host advertises" — a floor
-    // conditional on the advertised mode, which a flat `required[]` cannot state.
-    // Forcing it would either over-require (failing an honest single-mode host) or
-    // under-require (the vacuity this fix removes). It stays unspecified, and is
-    // therefore unprovable, until the model can express a discovery-conditional
-    // floor. Same for `openwop-interrupts`, `openwop-secrets`,
-    // `openwop-provider-policy`, `openwop-memory`, and `openwop-trigger-bridge`,
-    // whose prose sections do not yet name a settled floor set.
+    // RFC 0025 makes the `/v1/packs/*` read surface unconditional-when-shipped
+    // with NO discovery advert, and `profiles.md` §openwop-node-packs says the
+    // profile "is derivable from which scenarios pass" — so it is runtime-derived.
+    'openwop-node-packs': { required: ['pack-registry.test.ts', 'pack-registry-publish.test.ts'], runtimeDerived: true },
+    // ── Transcribed 2026-08-16 (RFC 0148 §C gap G7) ─────────────────────────────
+    // Each floor below is named in `profiles.md`'s section for the profile
+    // ("Floor (RFC 0148 §C)") and obeys `core-standard-profile.md` §C's membership
+    // rule: black-box, no seam, no soft-skip on the profile's OWN advert. Fixture-
+    // gated scenarios stay in (the conformance fixture IS the black-box seam and
+    // its absence records honestly as blocked/skipped), capability-gated ones are
+    // in only where the gate is the profile predicate itself.
+    // `profiles.md` §`openwop-interrupts`: the `clarification.request` envelope is
+    // the canonical interrupt envelope; the interrupt family proves resume.
+    'openwop-interrupts': { required: ['interrupt-clarification.test.ts'], requiredAnyPrefix: ['interrupt-'] },
+    // `profiles.md` §`openwop-secrets`: credential resolution per `run-options.md`
+    // §"Credential references" — the BYOK canary round-trip (`fixtures.md`
+    // §conformance-secrets-roundtrip, SR-1) is the profile's proof.
+    'openwop-secrets': { required: ['byok-roundtrip.test.ts'] },
+    // `profiles.md` §`openwop-provider-policy`: the four-mode taxonomy shape and
+    // its enforcement on the wire.
+    'openwop-provider-policy': { required: ['policies.test.ts', 'providerPolicyEnforcement.test.ts'] },
+    // `profiles.md` §`openwop-memory`: capability model shape, write attribution
+    // (RFC 0080 §A) and the degraded-projection contract (RFC 0080 §C).
+    'openwop-memory': {
+        required: [
+            'memory-capability-model-shape.test.ts',
+            'memory-attribution-shape.test.ts',
+            'memory-attribution-emits-on-write.test.ts',
+            'memory-degraded-projection.test.ts',
+        ],
+    },
+    // `profiles.md` §`openwop-trigger-bridge`: "The runtime conformance scenarios
+    // (`trigger-bridge-delivery.test.ts`, profile-gated) verify …" plus the shape.
+    'openwop-trigger-bridge': { required: ['trigger-bridge-shape.test.ts', 'trigger-bridge-delivery.test.ts'] },
+    // `profiles.md` §`openwop-replay-fork`: "This profile gates
+    // `replayDeterminism.test.ts` and `replay-fork.test.ts` … the conformance
+    // scenarios pass on whichever mode the host advertises." Discovery-conditional
+    // on `replay.modes` (RFC 0073 root family).
+    'openwop-replay-fork': {
+        required: [],
+        conditional: [
+            // `replay` mode carries caveat 1 (a replay MUST NOT re-fire external
+            // effects — unconditional, `replay.md`); the suppression scenario records
+            // `blocked` when no probeable mechanism is advertised, so a
+            // `sideEffectSuppression: none` host does NOT certify on determinism alone.
+            { path: 'replay.modes', includes: 'replay', required: ['replayDeterminism.test.ts', 'replay-side-effect-suppression.test.ts'] },
+            { path: 'replay.modes', includes: 'branch', required: ['replay-fork.test.ts'] },
+        ],
+    },
 };
 /** Is `profile` derivable from a discovery document? Maps a profile name to its predicate (RFC 0089 §B(1)). */
 export function profileDerivable(c, profile) {
@@ -517,9 +587,22 @@ export function verifyBundleProfile(bundle, profile) {
         return { profile, derivable, floorProven: false, valid: false, missingFloor: [], floorUnspecified: true };
     }
     const passed = new Set(bundle.results.passed.map(scenarioBasename));
-    const missingFloor = floor.required.filter((r) => !passed.has(scenarioBasename(r)));
+    // Discovery-conditional floors (RFC 0148 §C G7): evaluate the conditional
+    // branches against the bundle's own captured discovery document.
+    const requiredFiles = [...floor.required];
+    for (const c of floor.conditional ?? []) {
+        let cur = bundle.discovery.document;
+        for (const seg of c.path.split('.'))
+            cur = cur !== null && typeof cur === 'object' ? cur[seg] : undefined;
+        if (Array.isArray(cur) && cur.includes(c.includes))
+            requiredFiles.push(...c.required);
+    }
+    const missingFloor = requiredFiles.filter((r) => !passed.has(scenarioBasename(r)));
     const prefixOk = (floor.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
-    const floorProven = missingFloor.length === 0 && prefixOk;
+    // A conditional floor none of whose branches matched requires nothing — that
+    // is unprovable for a non-discovery-only profile, not proven.
+    const evaluable = floor.discoveryOnly === true || requiredFiles.length > 0 || (floor.requiredAnyPrefix ?? []).length > 0;
+    const floorProven = evaluable && missingFloor.length === 0 && prefixOk;
     return {
         profile,
         derivable,

package/dist/lib/requirement-ledger.js

@@ -0,0 +1,182 @@
+/**
+ * RFC 0148 §A — the requirement execution ledger.
+ *
+ * The program exists because a green bundle could overstate behavior that never
+ * ran. Every instance found so far shares one shape: **something absent was
+ * treated as something proven.** `verifyBundleProfile()` derived `floorProven`
+ * from `[].every(...)` over an undefined floor. A gated subtest 404'd and
+ * soft-skipped. A scenario early-returned and the file still counted as passed.
+ *
+ * So the ledger inverts the default. A requirement has **no** disposition until
+ * a scenario explicitly records one, and a requirement with no recorded
+ * disposition resolves to `blocked` — never to `executed-pass`. Silence is
+ * evidence of nothing, and the data structure now says so rather than relying on
+ * each author to remember it.
+ *
+ * That is the whole mechanism. Everything else here is bookkeeping.
+ */
+import { appendFileSync, readFileSync, existsSync } from 'node:fs';
+export const DISPOSITIONS = [
+    'executed-pass',
+    'executed-fail',
+    'skipped',
+    'inapplicable',
+    'blocked',
+];
+/**
+ * Dispositions that permit a profile to certify. `blocked` is deliberately NOT
+ * here: RFC 0148 §A says a blocked requirement in a claimed profile invalidates
+ * that profile's certification, because "we could not check" and "we checked and
+ * it holds" are the two states this program exists to stop conflating.
+ */
+export const CERTIFIABLE = [
+    'executed-pass',
+    'skipped',
+    'inapplicable',
+];
+const ledger = new Map();
+/**
+ * Append-only journal of every recording in call order (duplicates included).
+ * `setup.ts` marks the journal length before a file's tests and reads what was
+ * recorded since, so a file's own gate decisions can be found even when the
+ * same requirement id was recorded earlier in the worker.
+ */
+const journal = [];
+/**
+ * Record a requirement's outcome. Recording the same id twice with different
+ * dispositions throws: RFC 0148 §A says **exactly one** disposition per
+ * requirement, and a silent last-write-wins would let a later soft-skip
+ * overwrite an earlier real failure — the failure mode in reverse.
+ */
+export function recordRequirement(requirementId, disposition, detail, extras) {
+    const prior = ledger.get(requirementId);
+    if (prior !== undefined && prior.disposition !== disposition) {
+        throw new Error(`RFC 0148 §A: ${requirementId} already recorded as '${prior.disposition}', now '${disposition}'. ` +
+            'Exactly one disposition per requirement per run.');
+    }
+    if (disposition !== 'executed-pass' && (detail === undefined || detail.trim() === '')) {
+        throw new Error(`RFC 0148 §A: ${requirementId} recorded as '${disposition}' without a reason. ` +
+            'Anything other than executed-pass MUST say why, or the ledger records an outcome nobody can act on.');
+    }
+    const entry = {
+        requirementId,
+        disposition,
+        ...(detail === undefined ? {} : { detail }),
+        ...(extras?.assertionCount === undefined ? {} : { assertionCount: extras.assertionCount }),
+    };
+    ledger.set(requirementId, entry);
+    journal.push(entry);
+    // File sink (RFC 0148 acceptance item 2, S6). The in-memory map lives in a
+    // vitest worker; the `--certify` runner is a separate process reading a
+    // per-file JSON report. When the runner sets OPENWOP_LEDGER_PATH the worker
+    // appends every recording as one JSONL line so the runner can build
+    // requirement-level dispositions from what scenarios actually recorded —
+    // rather than inferring them from per-file pass/fail/skip, which cannot
+    // tell `skipped` from `inapplicable` from `blocked`. Best-effort: a sink
+    // failure must never turn a real assertion into a crash.
+    const sink = process.env['OPENWOP_LEDGER_PATH'];
+    if (sink !== undefined && sink !== '' && sink !== suspendedSink) {
+        try {
+            appendFileSync(sink, JSON.stringify(entry) + '\n');
+        }
+        catch {
+            /* ignore — the in-memory ledger is still authoritative for this worker */
+        }
+    }
+}
+/**
+ * Read a ledger JSONL file written through the sink above. Duplicate lines for
+ * the same id (a scenario re-recording the same disposition, or several files
+ * gating the same profile) collapse to one entry; a CONFLICT (two different
+ * dispositions for one id across workers) resolves to the least certifiable
+ * — `executed-fail` > `blocked` > `executed-pass` > `skipped` > `inapplicable`
+ * — because "one worker said it failed" outranks "another said it passed", and
+ * an unresolvable disagreement must never round toward certification.
+ * Returns an empty array when the file is absent.
+ */
+export function readLedgerFile(path) {
+    if (!existsSync(path))
+        return [];
+    const rank = { 'executed-fail': 0, blocked: 1, 'executed-pass': 2, skipped: 3, inapplicable: 4 };
+    const merged = new Map();
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+        if (line.trim() === '')
+            continue;
+        let e;
+        try {
+            e = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (typeof e.requirementId !== 'string' || !DISPOSITIONS.includes(e.disposition))
+            continue;
+        const prior = merged.get(e.requirementId);
+        if (prior === undefined || rank[e.disposition] < rank[prior.disposition])
+            merged.set(e.requirementId, e);
+    }
+    return [...merged.values()].sort((a, b) => a.requirementId.localeCompare(b.requirementId));
+}
+/**
+ * The disposition for a requirement. **Absent resolves to `blocked`, never to a
+ * pass.** This is the inversion the whole section turns on: a scenario that
+ * returned early, threw and swallowed, or was never written leaves no entry, and
+ * the honest reading of no entry is "this was not exercised".
+ */
+export function dispositionOf(requirementId) {
+    return ledger.get(requirementId)?.disposition ?? 'blocked';
+}
+export function entryOf(requirementId) {
+    return (ledger.get(requirementId) ?? {
+        requirementId,
+        disposition: 'blocked',
+        detail: 'no disposition recorded — the requirement was not exercised',
+    });
+}
+export function snapshot() {
+    return [...ledger.values()].sort((a, b) => a.requirementId.localeCompare(b.requirementId));
+}
+/** Test-support only. Production runs record once and read once. */
+let suspendedSink;
+/**
+ * Scenarios that exercise `recordRequirement` itself (the ledger's own unit
+ * tests) record REAL requirement ids as fixtures — e.g. the whole core-standard
+ * floor as `executed-pass`. With the file sink on, those fixture rows would
+ * reach the runner's ledger and, under the reader's conflict rank, out-vote a
+ * genuine `inapplicable` recorded by the scenario that owns the requirement.
+ * Such a test file calls this in `beforeAll` and the returned restore in
+ * `afterAll`: recordings made in between are kept in memory but NOT appended to
+ * the sink that was active at the time of the call. A different path set by the
+ * test itself (its own scratch sink) is unaffected.
+ */
+export function suspendSinkForFixtures() {
+    suspendedSink = process.env['OPENWOP_LEDGER_PATH'];
+    return () => {
+        suspendedSink = undefined;
+    };
+}
+/** Number of recordings so far in this worker (a mark for `journalSince`). */
+export function journalLength() {
+    return journal.length;
+}
+/** Every recording made since `mark` (from `journalLength()`), in call order. */
+export function journalSince(mark) {
+    return journal.slice(mark);
+}
+export function resetLedger() {
+    ledger.clear();
+    journal.length = 0;
+}
+/**
+ * Whether a profile's requirements permit certification. A profile with **no**
+ * requirements is NOT certifiable by this function — an empty requirement set
+ * is the `[].every(...)` shape that started all of this, and callers must
+ * distinguish "no floor by design" (`discoveryOnly`) from "no floor written yet"
+ * before reaching here.
+ */
+export function verifyProfileRequirements(profile, requirementIds) {
+    const blocking = requirementIds
+        .map(entryOf)
+        .filter((e) => !CERTIFIABLE.includes(e.disposition));
+    return { profile, certifiable: requirementIds.length > 0 && blocking.length === 0, blocking };
+}

package/dist/lib/requirement-registry.js

@@ -0,0 +1,110 @@
+/**
+ * RFC 0148 §A — stable requirement IDs for the certification floor.
+ *
+ * §A requires "every normative conformance assertion included in a certifiable
+ * profile" to carry a stable `requirementId`. This registry is the first tranche:
+ * the floor scenarios that `PROFILE_FLOOR_SCENARIOS` already makes certification
+ * depend on. It is deliberately NOT a sweep over all 421 scenario files.
+ *
+ * The reason is the measurement in `docs/RFC-LIFECYCLE-COHERENCE.md`, applied to
+ * a different surface: a gate that fires hundreds of times on its first run gets
+ * disabled rather than fixed. Tagging every assertion in one pass would produce a
+ * registry nobody could review, and an unreviewed requirement ID is worth less
+ * than no requirement ID — it looks like coverage.
+ *
+ * So the scope is exactly what certification consumes today. `requirementsFor()`
+ * returns the IDs a profile's claim rests on, and anything outside this registry
+ * is honestly outside §A's coverage rather than silently assumed covered.
+ *
+ * Adding a requirement is deliberately cheap; adding it *without* a scenario
+ * recording a disposition for it is deliberately loud, because the ledger
+ * resolves an unrecorded requirement to `blocked`.
+ */
+import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+/** `runs-lifecycle.test.ts` → `openwop.floor.runs-lifecycle`. */
+export function requirementIdForScenario(scenarioFile) {
+    return `openwop.floor.${scenarioFile.replace(/\.test\.ts$/, '')}`;
+}
+/** Prefix groups become one requirement: `interrupt-` → `openwop.floor.any.interrupt-`. */
+export function requirementIdForPrefix(prefix) {
+    return `openwop.floor.any.${prefix}`;
+}
+/**
+ * The requirement IDs a profile's certification rests on.
+ *
+ * Returns `null` — not an empty array — when the corpus has no floor for the
+ * profile. An empty array would flow into `verifyProfileRequirements()` and read
+ * as "nothing blocking", which is the `[].every(...)` shape this program exists
+ * to close. `null` forces the caller to decide between `discoveryOnly` (an empty
+ * floor by design) and unspecified (no floor written yet).
+ */
+/** Read a dot-path (RFC 0073 root families) out of a discovery document. */
+function readPath(doc, path) {
+    let cur = doc;
+    for (const seg of path.split('.')) {
+        if (cur === null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[seg];
+    }
+    return cur;
+}
+/**
+ * The scenario FILES a profile's floor requires against a given discovery
+ * document — the unconditional `required` list plus every `conditional` branch
+ * whose `path` array includes its `includes` value. `null` when the floor is
+ * conditional and no document was supplied (unevaluable ≠ empty), or when the
+ * profile has no floor at all.
+ */
+export function floorFilesFor(profile, document) {
+    const floor = PROFILE_FLOOR_SCENARIOS[profile];
+    if (floor === undefined)
+        return null;
+    const files = [...floor.required];
+    if (floor.conditional !== undefined && floor.conditional.length > 0) {
+        if (document === undefined)
+            return null;
+        for (const c of floor.conditional) {
+            const arr = readPath(document, c.path);
+            if (Array.isArray(arr) && arr.includes(c.includes))
+                files.push(...c.required);
+        }
+    }
+    return [...new Set(files)];
+}
+/**
+ * Requirement ids for a profile's floor. `document` is needed for a
+ * discovery-conditional floor (RFC 0148 §C G7 — `openwop-replay-fork`): without
+ * it such a floor is UNEVALUABLE and this returns `null`, never `[]`.
+ */
+export function requirementsFor(profile, document) {
+    const floor = PROFILE_FLOOR_SCENARIOS[profile];
+    if (floor === undefined)
+        return null;
+    if (floor.discoveryOnly === true)
+        return [];
+    const files = floorFilesFor(profile, document);
+    if (files === null)
+        return null;
+    return [
+        ...files.map(requirementIdForScenario),
+        ...(floor.requiredAnyPrefix ?? []).map(requirementIdForPrefix),
+    ];
+}
+/** Every registered requirement ID across every profile with a runtime floor. */
+export function allRequirements() {
+    const ids = new Set();
+    for (const [profile, floor] of Object.entries(PROFILE_FLOOR_SCENARIOS)) {
+        if (floor.discoveryOnly === true)
+            continue;
+        // every branch of a conditional floor is a registered requirement
+        for (const f of floor.required)
+            ids.add(requirementIdForScenario(f));
+        for (const c of floor.conditional ?? [])
+            for (const f of c.required)
+                ids.add(requirementIdForScenario(f));
+        for (const p of floor.requiredAnyPrefix ?? [])
+            ids.add(requirementIdForPrefix(p));
+        void profile;
+    }
+    return [...ids].sort();
+}